CA2750358A1 - Cryptography circuit particularly protected against information-leak observation attacks by the ciphering thereof - Google Patents
Cryptography circuit particularly protected against information-leak observation attacks by the ciphering thereof Download PDFInfo
- Publication number
- CA2750358A1 CA2750358A1 CA2750358A CA2750358A CA2750358A1 CA 2750358 A1 CA2750358 A1 CA 2750358A1 CA 2750358 A CA2750358 A CA 2750358A CA 2750358 A CA2750358 A CA 2750358A CA 2750358 A1 CA2750358 A1 CA 2750358A1
- Authority
- CA
- Canada
- Prior art keywords
- key
- circuit
- algorithm
- attacks
- fpga
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/002—Countermeasures against attacks on cryptographic mechanisms
- H04L9/003—Countermeasures against attacks on cryptographic mechanisms for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]
-
- G—PHYSICS
- G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
- G09C—CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
- G09C1/00—Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
- H04L9/0625—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/04—Masking or blinding
- H04L2209/046—Masking or blinding of operations, operands or results of the operations
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/12—Details relating to cryptographic hardware or logic circuitry
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Storage Device Security (AREA)
- Facsimile Transmission Control (AREA)
- Semiconductor Integrated Circuits (AREA)
Abstract
The invention relates to a cryptography circuit that is particularly protected against attacks based on the observation of information leaks. The cryptography circuit (21) includes a functional key k c for running an cryptography algorithm. It comprises a second unique key k i that is particular to the circuit for protecting y masking the functional and confidential key k c or a confidential implementation of the algorithm.
Description
CRYPTOGRAPHY CIRCUIT PARTICULARLY PROTECTED AGAINST
INFORMATION-LEAK OBSERVATION ATTACKS BY THE CIPHERING
THEREOF
The present invention relates to a cryptography circuit, protected notably against information-leak observation attacks by their encryption.
More and more communication and information processing systems are resorting to cryptographic methods to guard against any malicious exaction on the data which are required to travel over public media. In particular, encryption ensures the confidentiality of the data, cryptographic digest ensures their integrity and electronic signing ensures their authenticity. In each of these cases, a common secret is put into play between the party in charge of sending the data and the party in charge of receiving these data, these two parties possibly being one and the same. For an attacker hostile to these security mechanisms, that is to say wishing to illegitimately ascertain the content of a message, to modify the content of a transaction, to render impersonal or to deny the provenance of an exchange, a priority objective is to retrieve the common secret so as to benefit with impunity from powers similar to the authorized receiving party.
Direct attacks against cryptography algorithms have been and are still sometimes possible. Nonetheless, a continuous decrease in logical flaws is being observed. In particular, more and more cryptography algorithms are standardized after being passed through an international scrutiny test. This was notably the case for AES (Advanced Encrypton Standard) symmetric encryption at the end of the 1990's. The same scenario is currently unfurling for the future version 3 of the SHA secure hash algorithm.
However, with the increasing roamability of means for communication and information processing, new attacks are becoming conceivable. By observing the temporal behavior of a system, in terms of execution speed, its comprising electronics, in terms of energy consumption by a DPA attack for example, or its radiative behavior, in terms of magnetic radiation by an EMA
attack for example, a great deal of information may leak. Protections against these attacks on the side channels have been proposed, on the basis notably:
INFORMATION-LEAK OBSERVATION ATTACKS BY THE CIPHERING
THEREOF
The present invention relates to a cryptography circuit, protected notably against information-leak observation attacks by their encryption.
More and more communication and information processing systems are resorting to cryptographic methods to guard against any malicious exaction on the data which are required to travel over public media. In particular, encryption ensures the confidentiality of the data, cryptographic digest ensures their integrity and electronic signing ensures their authenticity. In each of these cases, a common secret is put into play between the party in charge of sending the data and the party in charge of receiving these data, these two parties possibly being one and the same. For an attacker hostile to these security mechanisms, that is to say wishing to illegitimately ascertain the content of a message, to modify the content of a transaction, to render impersonal or to deny the provenance of an exchange, a priority objective is to retrieve the common secret so as to benefit with impunity from powers similar to the authorized receiving party.
Direct attacks against cryptography algorithms have been and are still sometimes possible. Nonetheless, a continuous decrease in logical flaws is being observed. In particular, more and more cryptography algorithms are standardized after being passed through an international scrutiny test. This was notably the case for AES (Advanced Encrypton Standard) symmetric encryption at the end of the 1990's. The same scenario is currently unfurling for the future version 3 of the SHA secure hash algorithm.
However, with the increasing roamability of means for communication and information processing, new attacks are becoming conceivable. By observing the temporal behavior of a system, in terms of execution speed, its comprising electronics, in terms of energy consumption by a DPA attack for example, or its radiative behavior, in terms of magnetic radiation by an EMA
attack for example, a great deal of information may leak. Protections against these attacks on the side channels have been proposed, on the basis notably:
2 - of concealment, which involves rendering the leakage constant, in this instance independent of the secret;
- of masking, which involves rendering the leakage random, that is to say unpredictable and therefore unexploitable.
These two techniques make it possible to increase the difficulty of attacks aimed at retrieving information, but they nonetheless remain vulnerable to attacks which would profit from implementational defects. Examples of DPA
attacks are described in the document by P.Kocher et al: Differential Power Analysis, In proceedings of CRYPT'99, volume 1666 of LNCS, pages 338-397, Springer-Verlag, 1999. Examples of EMA attacks are described in the document by K.Gandolfi et al: Electromagnetic Analysis - Concrete Results, In CHES, volume 2162 of LNCS, pages 251-261, Springer-Verlag, 2001.
There exist numerous potential or substantiated examples of vulnerability.
The following may notably be cited:
concealment based on differential logic (such as WDDL) may be vulnerable to an attack on differences in cumulative combinatorial lags between one or the other of the calculation phase, evaluation phase and precharge phase the masking may be sensitive to high-order attacks, termed HO - DPA.
An aim of the invention is notably to counter these attacks, notably of the DPA or EMA type. For this purpose, the subject of the invention is a cryptography circuit comprising a functional key k , for executing a cryptography algorithm, characterized in that said circuit comprises a second key k , independent of k and specific to each instance of said circuit, making it possible to protect the latter against attacks exploiting the side channels of the circuit.
This second key can either be stored in a dedicated storage unit or be specific to the component.
The functional key k ~ is for example masked by the second key k + by combining the two keys via the XOR operation, an input variable X being encrypted by the masked key k, a k;
The second key k ; serves for example to protect the key k , by virtue of a confidential implementation.
- of masking, which involves rendering the leakage random, that is to say unpredictable and therefore unexploitable.
These two techniques make it possible to increase the difficulty of attacks aimed at retrieving information, but they nonetheless remain vulnerable to attacks which would profit from implementational defects. Examples of DPA
attacks are described in the document by P.Kocher et al: Differential Power Analysis, In proceedings of CRYPT'99, volume 1666 of LNCS, pages 338-397, Springer-Verlag, 1999. Examples of EMA attacks are described in the document by K.Gandolfi et al: Electromagnetic Analysis - Concrete Results, In CHES, volume 2162 of LNCS, pages 251-261, Springer-Verlag, 2001.
There exist numerous potential or substantiated examples of vulnerability.
The following may notably be cited:
concealment based on differential logic (such as WDDL) may be vulnerable to an attack on differences in cumulative combinatorial lags between one or the other of the calculation phase, evaluation phase and precharge phase the masking may be sensitive to high-order attacks, termed HO - DPA.
An aim of the invention is notably to counter these attacks, notably of the DPA or EMA type. For this purpose, the subject of the invention is a cryptography circuit comprising a functional key k , for executing a cryptography algorithm, characterized in that said circuit comprises a second key k , independent of k and specific to each instance of said circuit, making it possible to protect the latter against attacks exploiting the side channels of the circuit.
This second key can either be stored in a dedicated storage unit or be specific to the component.
The functional key k ~ is for example masked by the second key k + by combining the two keys via the XOR operation, an input variable X being encrypted by the masked key k, a k;
The second key k ; serves for example to protect the key k , by virtue of a confidential implementation.
3 The second key k i serves for example to protect a confidential algorithm, notably that comprising a standard cryptographic algorithm customized by the bracketing of two secret functions protected by masking with the key k , .
The second key k : is for example created by a function of the PUF
(Physically Unclonable Function) or POK (Physically Obfuscated Key) type.
The second key k ; can also be programmed after fabrication of the circuit, by customization, with a unique random value in a secure enclosure.
The masking introduced by the second key k , may be protected against HO-DPA high-order attacks.
The knowledge of the second key k serving as implementation key unique to a circuit, allows for example the use of a protection control procedure to privileged users responsible for said control.
The may be realized on a programmable circuit of the FPGA type.
The second key k , may be customized by way of an FPGA's programming file.
Advantageously, the circuit may be realized by a software implementation.
It comprises for example a third key k b for encrypting the programming file (25) of said FPGA circuit, this conferring the confidentiality of the external storage and of the transfer of the key k : to the FPGA.
The cardinal of the second key k , is for example equal to the cardinal of the functional key k ~ , this so as to render hidden-channel attack on k i more difficult than cryptanalytic attack on k , .
The cardinal of the cardinal of the third key k b is greater than or equal to the cardinal of the functional key k , .
The encryption algorithm is the DES algorithm.
Other characteristics and advantages of the invention will become apparent with the aid of the description which follows, given in relation to appended drawings which represent:
- Figure 1, an exemplary circuit comprising protection by masking of the key of the DES algorithm.
- Figure 2, the same circuit without masking.
- Figure 3, an example of pre-encoding added to the algorithm so as to protect an implementation by masking.
The second key k : is for example created by a function of the PUF
(Physically Unclonable Function) or POK (Physically Obfuscated Key) type.
The second key k ; can also be programmed after fabrication of the circuit, by customization, with a unique random value in a secure enclosure.
The masking introduced by the second key k , may be protected against HO-DPA high-order attacks.
The knowledge of the second key k serving as implementation key unique to a circuit, allows for example the use of a protection control procedure to privileged users responsible for said control.
The may be realized on a programmable circuit of the FPGA type.
The second key k , may be customized by way of an FPGA's programming file.
Advantageously, the circuit may be realized by a software implementation.
It comprises for example a third key k b for encrypting the programming file (25) of said FPGA circuit, this conferring the confidentiality of the external storage and of the transfer of the key k : to the FPGA.
The cardinal of the second key k , is for example equal to the cardinal of the functional key k ~ , this so as to render hidden-channel attack on k i more difficult than cryptanalytic attack on k , .
The cardinal of the cardinal of the third key k b is greater than or equal to the cardinal of the functional key k , .
The encryption algorithm is the DES algorithm.
Other characteristics and advantages of the invention will become apparent with the aid of the description which follows, given in relation to appended drawings which represent:
- Figure 1, an exemplary circuit comprising protection by masking of the key of the DES algorithm.
- Figure 2, the same circuit without masking.
- Figure 3, an example of pre-encoding added to the algorithm so as to protect an implementation by masking.
4 Figure 4, an illustration of the principle of realizing a circuit according to the invention.
Figure 1 presents a mode of masking to which the invention may be applied.
More particularly, Figure 1 presents by way of example an illustration of the masking of the DES (Data Encryption Standard) algorithm implemented notably according to the architecture overviewed in the document by S.Guilley et al: A fast Pipelined MultiMode DES Architecture Operating in IP
Representation, Integration, The VLSI Journal, 40(4) pages 479-489, July 2007, DOI. The circuit of Figure 1 is for example realized in a programmable logic circuit of FPGA (Field Programmable Gate Array) type. In this algorithm, the data path is split into two parts, left and right.
By way of comparison Figure 2 represents the same circuit highlighting the hardware overhead for ensuring protection by masking, the circuits giving rise to this overhead being indicated by dashed lines.
An input message 1 is therefore apportioned between a left data register 3 and a right data register 4. A mask 2 is apportioned between a left mask register 5 and a right mask register 6. Before being stored in the left and right data registers, the data of the message are masked by combining with the mask data by means of an XOR gate 7 on the left and of an XOR gate 8 on the right. The encryption key 9, k , is also masked by the mask m by a Feistel function 10. The masked datum of the right register 6 and the half-mask of the right register 2 form the inputs of the Feistel function wherein the right masked datum is encrypted by a first substitution box 9 and where the right half-mask is encrypted by a second substitution box 16. The data of the left data register 5 and left mask register 1 are combined respectively with the right datum and with the new mask, at the output of the Feistel function, by means of XOR gates 11, 12 and are thereafter looped back to the right registers, the right and left data being subsequently recombined by XOR
gates 13, 14 so as to output 15 the encrypted message. In a circuit of the type of Figure 1, only the data registers 5, 6 are assumed to leak.
A circuit according to the invention preserves the leak but renders it encrypted, therefore incomprehensible. Thus an attacker carrying out for example an attack of DPA or EMA type finds only the variable:
K M (1) that is to say the secret key K itself encrypted by a mask M . This mode of
Figure 1 presents a mode of masking to which the invention may be applied.
More particularly, Figure 1 presents by way of example an illustration of the masking of the DES (Data Encryption Standard) algorithm implemented notably according to the architecture overviewed in the document by S.Guilley et al: A fast Pipelined MultiMode DES Architecture Operating in IP
Representation, Integration, The VLSI Journal, 40(4) pages 479-489, July 2007, DOI. The circuit of Figure 1 is for example realized in a programmable logic circuit of FPGA (Field Programmable Gate Array) type. In this algorithm, the data path is split into two parts, left and right.
By way of comparison Figure 2 represents the same circuit highlighting the hardware overhead for ensuring protection by masking, the circuits giving rise to this overhead being indicated by dashed lines.
An input message 1 is therefore apportioned between a left data register 3 and a right data register 4. A mask 2 is apportioned between a left mask register 5 and a right mask register 6. Before being stored in the left and right data registers, the data of the message are masked by combining with the mask data by means of an XOR gate 7 on the left and of an XOR gate 8 on the right. The encryption key 9, k , is also masked by the mask m by a Feistel function 10. The masked datum of the right register 6 and the half-mask of the right register 2 form the inputs of the Feistel function wherein the right masked datum is encrypted by a first substitution box 9 and where the right half-mask is encrypted by a second substitution box 16. The data of the left data register 5 and left mask register 1 are combined respectively with the right datum and with the new mask, at the output of the Feistel function, by means of XOR gates 11, 12 and are thereafter looped back to the right registers, the right and left data being subsequently recombined by XOR
gates 13, 14 so as to output 15 the encrypted message. In a circuit of the type of Figure 1, only the data registers 5, 6 are assumed to leak.
A circuit according to the invention preserves the leak but renders it encrypted, therefore incomprehensible. Thus an attacker carrying out for example an attack of DPA or EMA type finds only the variable:
K M (1) that is to say the secret key K itself encrypted by a mask M . This mode of
5 protection of the key K is known by the name of Vernam encryption, with the "exclusive or" operation, also called XOR, and denoted by e , a Vernam code being a code that can be encrypted with the XOR operation. A
cryptography circuit according to the invention is therefore protected against attacks on the hidden channels by Vernam encryption of information leaks.
There exist application fields where the encryption algorithm is completely customized. Such is the case for example in the public or private sphere for GSM or pay-per-view television which rely on confidential cryptography. An argument customarily put forward to justify this choice is that attacks on the side channels, so-called SCA (Side-Channel Attacks), are impossible since the leakage function to be correlated with the circuit is unknown. In the document K.Tiri et al: Side-Channel Leakage Tolerant Architectures, In ITNG'06 - Proceedings of the Third International Conference on Information Technology, New Generation, pages 204-209, Washington DC, USA, 2006 IEEE Computer Society, it is proposed to modify at one and the same time the implementation and the functionality of an algorithm, with or without overhead in terms of quantity of hardware. A drawback of the previous two procedures is that the encryption becomes functionally secret. This may be admissible in certain typical cases when security professionals implement the system and its deployment. But in the great majority of cases, when the design and the distribution of the encrypting systems is difficult to monitor, this scenario is very uncertain. Once the functionality of the secret has been recovered, an attack of the DPA type becomes possible again in a trivial manner. Moreover certain certification policies, such as for example FIPS-140, demand the non-customized use of cryptography standards, this rendering all the SCA-tolerant procedures advocated, notably in the document by K.Tiri et al, prohibitive.
According to the invention, to carry out an encryption, while complying fully notably with the known functional specification of this encryption, a protection by masking is performed using a mask specific to the cryptography circuit to
cryptography circuit according to the invention is therefore protected against attacks on the hidden channels by Vernam encryption of information leaks.
There exist application fields where the encryption algorithm is completely customized. Such is the case for example in the public or private sphere for GSM or pay-per-view television which rely on confidential cryptography. An argument customarily put forward to justify this choice is that attacks on the side channels, so-called SCA (Side-Channel Attacks), are impossible since the leakage function to be correlated with the circuit is unknown. In the document K.Tiri et al: Side-Channel Leakage Tolerant Architectures, In ITNG'06 - Proceedings of the Third International Conference on Information Technology, New Generation, pages 204-209, Washington DC, USA, 2006 IEEE Computer Society, it is proposed to modify at one and the same time the implementation and the functionality of an algorithm, with or without overhead in terms of quantity of hardware. A drawback of the previous two procedures is that the encryption becomes functionally secret. This may be admissible in certain typical cases when security professionals implement the system and its deployment. But in the great majority of cases, when the design and the distribution of the encrypting systems is difficult to monitor, this scenario is very uncertain. Once the functionality of the secret has been recovered, an attack of the DPA type becomes possible again in a trivial manner. Moreover certain certification policies, such as for example FIPS-140, demand the non-customized use of cryptography standards, this rendering all the SCA-tolerant procedures advocated, notably in the document by K.Tiri et al, prohibitive.
According to the invention, to carry out an encryption, while complying fully notably with the known functional specification of this encryption, a protection by masking is performed using a mask specific to the cryptography circuit to
6 be protected. A circuit according to the invention comprises a masking architecture where the mask M, specific to the circuit, is simply constant and unknown to the user or to the designer of the circuit.
It may be demonstrated that a masking path according to Figure 1 does indeed carry out a Vernam encryption of the cryptographic key in accordance with equation (1) hereinabove, within the framework of a first-order DPA
attack, that is to say an attack where only the data registers 5, 6 are assumed to leak. Moreover, any variant around the masking can also be used to implement the invention: it suffices in fact that the implementation be expressed differently from the reference implementation while preserving the functionality. In the case of the masking, the reference implementation corresponds to that with a zero mask (everything zero); but as soon as the mask is nonzero, the implementation changes, without however modifying the functionality. Now, it is also possible to change representation so as to introduce variability into the implementation. For example, in "A New DPA
Countermeasure Based on Permutation Tables. In SCN, volume 5229 of Lecture Notes in Computer Science, pages 278-292. Springer", Jean-Sebastian CORON proposes to modify the elementary operation parts of the AES with the introduction of 2 bijections 4-bit --- 4-bit, in such a way, however, that by assembling them, they do indeed give the calculation of a conventional AES. This change of representation can also give rise to a secret implementation, the information leakage of which is, however, not studied in this document.
Thus, first-order correlation attacks are rendered impossible since the leakage model is unknown. Moreover, attacks which rely on the construction of a set, or catalog, of measurements, such as so-called "template" attacks, are also rendered infeasible since each implementation being unique, it is impossible to construct a universal catalog.
Advantageously, with the invention, the diversity of the implementations is comparable, or indeed equal, to the number of cryptographic keys. In particular, an attack of "second preimage" type is then impossible. The probability of finding by chance a circuit whose key is programmable having the same mask as a circuit in active service is comparable, or indeed equal,
It may be demonstrated that a masking path according to Figure 1 does indeed carry out a Vernam encryption of the cryptographic key in accordance with equation (1) hereinabove, within the framework of a first-order DPA
attack, that is to say an attack where only the data registers 5, 6 are assumed to leak. Moreover, any variant around the masking can also be used to implement the invention: it suffices in fact that the implementation be expressed differently from the reference implementation while preserving the functionality. In the case of the masking, the reference implementation corresponds to that with a zero mask (everything zero); but as soon as the mask is nonzero, the implementation changes, without however modifying the functionality. Now, it is also possible to change representation so as to introduce variability into the implementation. For example, in "A New DPA
Countermeasure Based on Permutation Tables. In SCN, volume 5229 of Lecture Notes in Computer Science, pages 278-292. Springer", Jean-Sebastian CORON proposes to modify the elementary operation parts of the AES with the introduction of 2 bijections 4-bit --- 4-bit, in such a way, however, that by assembling them, they do indeed give the calculation of a conventional AES. This change of representation can also give rise to a secret implementation, the information leakage of which is, however, not studied in this document.
Thus, first-order correlation attacks are rendered impossible since the leakage model is unknown. Moreover, attacks which rely on the construction of a set, or catalog, of measurements, such as so-called "template" attacks, are also rendered infeasible since each implementation being unique, it is impossible to construct a universal catalog.
Advantageously, with the invention, the diversity of the implementations is comparable, or indeed equal, to the number of cryptographic keys. In particular, an attack of "second preimage" type is then impossible. The probability of finding by chance a circuit whose key is programmable having the same mask as a circuit in active service is comparable, or indeed equal,
7 to the probability of guessing the right key by chance, that is to say of succeeding with an exhaustive search on the key by brute force attack.
In the example of Figure 1, the hardware added in order to implement the masking is formed of the left I and right 2 mask registers and of the XOR
gates 12, 13, 14 combining the masks with the data as well as of the substitution circuits 16 of the Feistel function processing the output of the right mask register.
Within the framework of an ASIC or FPGA based realization, the masking of other types of cryptographic primitives may be automated with the assistance of suitable CAD tools operating directly on the source code.
It is interesting to note that the protection procedure can be applied generally to any implementation which contains a secret that might leak via a side channel. An immediate example is the protection of encryption keys, but signature keys are equally well protected in the same way.
Moreover, instead of protecting a parameter of a cryptographic algorithm, it is also possible to protect the algorithm itself, if it is confidential. This happens in sectors such as pay-per-view television, where a non-interoperable cryptography may be implemented since the communications are encrypted point-to-point (satellite toward decoder). It is then usual to use a standardized algorithm while modifying one or more elements therein (such as the substitution tables or the diffusion functions). In this way, customization of the algorithm is achieved without running the risk of weakening its security.
Figure 3 illustrates another way of proceeding. In this example, a standard algorithm A is reused as is, but to bracket it with external encodings (EEin and EEout), so that the function carried out is no longer A, but the composition EEout A o EEin. An explanation of this principle is given in the introduction to the article by C. Clavier: Secret External Encodings Do Not Prevent Transient Fault Analysis, in CHES'07, volume 4727 of Lecture Notes in Computer Science, pages 181-194. The left part 30, 31, 32 of Figure 3 shows how a masking technique can prevent the values EE(X) from leaking, the function EE 30 being bracketed by two registers 31, 32 where the first register 31 receives the datum x m. The function EE' 33 disposed in parallel, defined as EE'(a,b).=EE(a) EE(a b), ensures that demasking
In the example of Figure 1, the hardware added in order to implement the masking is formed of the left I and right 2 mask registers and of the XOR
gates 12, 13, 14 combining the masks with the data as well as of the substitution circuits 16 of the Feistel function processing the output of the right mask register.
Within the framework of an ASIC or FPGA based realization, the masking of other types of cryptographic primitives may be automated with the assistance of suitable CAD tools operating directly on the source code.
It is interesting to note that the protection procedure can be applied generally to any implementation which contains a secret that might leak via a side channel. An immediate example is the protection of encryption keys, but signature keys are equally well protected in the same way.
Moreover, instead of protecting a parameter of a cryptographic algorithm, it is also possible to protect the algorithm itself, if it is confidential. This happens in sectors such as pay-per-view television, where a non-interoperable cryptography may be implemented since the communications are encrypted point-to-point (satellite toward decoder). It is then usual to use a standardized algorithm while modifying one or more elements therein (such as the substitution tables or the diffusion functions). In this way, customization of the algorithm is achieved without running the risk of weakening its security.
Figure 3 illustrates another way of proceeding. In this example, a standard algorithm A is reused as is, but to bracket it with external encodings (EEin and EEout), so that the function carried out is no longer A, but the composition EEout A o EEin. An explanation of this principle is given in the introduction to the article by C. Clavier: Secret External Encodings Do Not Prevent Transient Fault Analysis, in CHES'07, volume 4727 of Lecture Notes in Computer Science, pages 181-194. The left part 30, 31, 32 of Figure 3 shows how a masking technique can prevent the values EE(X) from leaking, the function EE 30 being bracketed by two registers 31, 32 where the first register 31 receives the datum x m. The function EE' 33 disposed in parallel, defined as EE'(a,b).=EE(a) EE(a b), ensures that demasking
8 remains possible. Thus, by virtue of the addition of the hardware 33, 34, 35 represented in the right part of Figure 3, none of the registers contains EE(x), whatever the input X to the algorithm. In this way, it is impossible to backtrack to an arbitrary item of information about the secret external encoding EE. Hereinafter, without however losing generality, concentration is placed on the typical case of the protection against leakage of a cryptographic key.
A solution of the FPGA type advantageously allows each circuit to have its own configuration, even during large-scale deployment. In particular with an FPGA solution, it is needless to recompile a whole system in order to modify a value, such as the mask specific to a component notably, in order to customize it. This implies that Kerckhoffs' principle is not violated, each implementation being actually secret, but unique. The compromising of an implementation does not allow the compromising of all the setups.
The retro-design of the functionality of certain FPGA circuits may be made possible on account of the fact that it is programmed software-wise, in a file situated in a permanently readable memory. To avoid such a retro-design, it is possible to use a type of FPGA making it possible to encrypt this file, termed "bitstream". Thus, the protection is itself kept confidential by cryptographic means. Code obfuscation is an additional parry to complicate the operation aimed at backtracking from machine language to a high-level specification.
Figure 4 illustrates in a schematic and simplified manner an exemplary circuit according to the invention. This circuit 21, of FPGA type, involves three keys.
A functional key k ~ serves to implement the encryption in the circuit 21.
This encryption is for example the DES algorithm 23 which transforms an input variable x into an enciphered variable y = DES (x, k,) inside a register 22.
A non-functional key k ; serves to mask the functional key k c . It is this key k , which forms the mask M of the functional key, an XOR operator combines these two keys into k, e k; . The key k 1 therefore serves to protect the functional key k , of the DES implementation against information
A solution of the FPGA type advantageously allows each circuit to have its own configuration, even during large-scale deployment. In particular with an FPGA solution, it is needless to recompile a whole system in order to modify a value, such as the mask specific to a component notably, in order to customize it. This implies that Kerckhoffs' principle is not violated, each implementation being actually secret, but unique. The compromising of an implementation does not allow the compromising of all the setups.
The retro-design of the functionality of certain FPGA circuits may be made possible on account of the fact that it is programmed software-wise, in a file situated in a permanently readable memory. To avoid such a retro-design, it is possible to use a type of FPGA making it possible to encrypt this file, termed "bitstream". Thus, the protection is itself kept confidential by cryptographic means. Code obfuscation is an additional parry to complicate the operation aimed at backtracking from machine language to a high-level specification.
Figure 4 illustrates in a schematic and simplified manner an exemplary circuit according to the invention. This circuit 21, of FPGA type, involves three keys.
A functional key k ~ serves to implement the encryption in the circuit 21.
This encryption is for example the DES algorithm 23 which transforms an input variable x into an enciphered variable y = DES (x, k,) inside a register 22.
A non-functional key k ; serves to mask the functional key k c . It is this key k , which forms the mask M of the functional key, an XOR operator combines these two keys into k, e k; . The key k 1 therefore serves to protect the functional key k , of the DES implementation against information
9 leaks 24, by observation of magnetic radiation or of instantaneous consumption notably.
Another non-functional key k b serves to protect the secret elements of the "bitstream" file 25, that is to say at least k , or indeed k ~ .
Preferably, in this scheme, the keys are dimensioned in such a way that:
Ik, I= Ik1 I (2) and Ikb I > Ik, I (3) l k i I, I k b I, Ik I expressing respectively the cardinal of k i , of k b and of k According to the invention the implementation of the cryptography algorithm 23 is such that the enciphered variable Y is functionally independent of the key k ; protecting the encryption key k . of the variable, the information leaks of the setup being as diverse as 21kil (2 to the power Ik i I ).
In the case of a DES algorithm, y = DES (x, k., k;) with Y functionally independent of k i .
It should be noted that a first-order attack is not simply rendered more difficult but impossible. Since it is necessary to guess k - knowing k, e k,, k , being totally unknown, including to a user or to a designer. In this, the invention affords a high degree of confidence, security being proven against any adversary having a calculation force of less than 2Ik'H . This amounts to the security level of the DES algorithm itself when l k , I = 1k, I.
It is possible to use a function of PUF (Physically Unclonable Functions) or POK (Physically Obfuscated Key) type, (i.e. implementation-specific physical key), or any other system making it possible to generate a secret specific to the circuit 21 instead of a key supplied from outside, via a public-key infrastructure, termed PKI, or any other mechanism for customizing confidence.
3o The second key k , can still be programmed after fabrication of the circuit with a single random value in a secure enclosure.
It is also possible to use a masking mechanism with constant mask, which moreover uses counter-measures to attacks on the combinatorial logic, also known by the name "Shallow Attack", or against HO-DPA attacks.
It should be noted that an attack on the algorithmic masking exploiting the presence of non-functional transitions, also called "glitches", hardly dependent in the secret mask, such as presented notably in the document by S.Mangard et al: Successfully Attacking Masked AES Hardware 5 Implementations, In LNCS, editor, Proceedings of CHES'05, volume 3659 of LNCS, pages 157-171, Springer, September 2005, Edinburgh, Scotland, does not apply to a secret implementation, since it is impossible to carry out a simulation of the circuit, not knowing it. In fact, this attack relies on a correlation with a pre-characterized model. This step is infeasible with a
Another non-functional key k b serves to protect the secret elements of the "bitstream" file 25, that is to say at least k , or indeed k ~ .
Preferably, in this scheme, the keys are dimensioned in such a way that:
Ik, I= Ik1 I (2) and Ikb I > Ik, I (3) l k i I, I k b I, Ik I expressing respectively the cardinal of k i , of k b and of k According to the invention the implementation of the cryptography algorithm 23 is such that the enciphered variable Y is functionally independent of the key k ; protecting the encryption key k . of the variable, the information leaks of the setup being as diverse as 21kil (2 to the power Ik i I ).
In the case of a DES algorithm, y = DES (x, k., k;) with Y functionally independent of k i .
It should be noted that a first-order attack is not simply rendered more difficult but impossible. Since it is necessary to guess k - knowing k, e k,, k , being totally unknown, including to a user or to a designer. In this, the invention affords a high degree of confidence, security being proven against any adversary having a calculation force of less than 2Ik'H . This amounts to the security level of the DES algorithm itself when l k , I = 1k, I.
It is possible to use a function of PUF (Physically Unclonable Functions) or POK (Physically Obfuscated Key) type, (i.e. implementation-specific physical key), or any other system making it possible to generate a secret specific to the circuit 21 instead of a key supplied from outside, via a public-key infrastructure, termed PKI, or any other mechanism for customizing confidence.
3o The second key k , can still be programmed after fabrication of the circuit with a single random value in a secure enclosure.
It is also possible to use a masking mechanism with constant mask, which moreover uses counter-measures to attacks on the combinatorial logic, also known by the name "Shallow Attack", or against HO-DPA attacks.
It should be noted that an attack on the algorithmic masking exploiting the presence of non-functional transitions, also called "glitches", hardly dependent in the secret mask, such as presented notably in the document by S.Mangard et al: Successfully Attacking Masked AES Hardware 5 Implementations, In LNCS, editor, Proceedings of CHES'05, volume 3659 of LNCS, pages 157-171, Springer, September 2005, Edinburgh, Scotland, does not apply to a secret implementation, since it is impossible to carry out a simulation of the circuit, not knowing it. In fact, this attack relies on a correlation with a pre-characterized model. This step is infeasible with a
10 circuit according to the invention, except for a possible clued-up attacker who would know the design of the masks of the ASIC produced, or the "bitstream"
file of the FPGA, or who would have a sample where the mask can be chosen. To prevent this possibility, the PUF function described previously can notably be used.
Certain proprietary algorithms, in particular the standard algorithms encapsulated between two secret encodings, are not resistant to perturbation attacks as shown notably in the document by C.Clavier: Secret External Encodings Do Not Prevent Transient Fault Analysis, In CHES, volume 4727 of Lecture Notes in Computer Science, pages 181-194, Springer, 2007. This class of attack requires that the attacker be able to fix the value of a register at a known value, such as 0x00 for example. In a circuit protected by an implementation key k , according to the invention, this is very difficult in practice if the data register and mask register are disjoint, since the attacker would then have to achieve multiple faults that are much more difficult to generate than simple faults.
A type of protection according to the invention, with implementation key k can advantageously be combined with other protections such as for example the usual protections for detecting faults, at the RTL level in respect of coding, or the physical level in respect of encapsulation. This makes it possible to attain a high level of protection both against passive attacks and against active attacks.
file of the FPGA, or who would have a sample where the mask can be chosen. To prevent this possibility, the PUF function described previously can notably be used.
Certain proprietary algorithms, in particular the standard algorithms encapsulated between two secret encodings, are not resistant to perturbation attacks as shown notably in the document by C.Clavier: Secret External Encodings Do Not Prevent Transient Fault Analysis, In CHES, volume 4727 of Lecture Notes in Computer Science, pages 181-194, Springer, 2007. This class of attack requires that the attacker be able to fix the value of a register at a known value, such as 0x00 for example. In a circuit protected by an implementation key k , according to the invention, this is very difficult in practice if the data register and mask register are disjoint, since the attacker would then have to achieve multiple faults that are much more difficult to generate than simple faults.
A type of protection according to the invention, with implementation key k can advantageously be combined with other protections such as for example the usual protections for detecting faults, at the RTL level in respect of coding, or the physical level in respect of encapsulation. This makes it possible to attain a high level of protection both against passive attacks and against active attacks.
Claims (16)
1. A cryptography circuit (21) comprising a functional key k c for executing a cryptography algorithm, characterized in that said circuit comprises a second key k i independent of k c and specific to each instance of said circuit, making it possible to protect the latter against the attacks exploiting the side channels of said circuit.
2. The circuit as claimed in claim 1, characterized in that the functional key k c is masked by the second key k i by combining the two keys via the XOR
operation, an input variable x being encrypted by the masked key k c ~ k i.
operation, an input variable x being encrypted by the masked key k c ~ k i.
3. The circuit as claimed in claim 1, characterized in that the second key k i serves to protect the key by virtue of a confidential implementation.
4. The circuit as claimed in claim 1, characterized in that the second key k i serves to protect a confidential algorithm.
5. The circuit as claimed in claim 4, characterized in that the confidential algorithm comprises a standard cryptographic algorithm customized by the bracketing of two secret functions (30, 31) protected by masking with the key k i .
6. The circuit as claimed in any one of the preceding claims, characterized in that the second key k i is created by a function of the PUF (Physically Unclonable Function) or POK (Physically Obfuscated Key) type.
7. The circuit as claimed in any one of claims 1 to 5, characterized in that the second key k i is programmed after fabrication of said circuit, by customization with a unique random value in a secure enclosure.
8. The circuit as claimed in any one of the preceding claims, characterized in that the masking introduced by the second key k i is protected against HO-DPA high-order attacks.
9. The circuit as claimed in any one of the preceding claims, characterized in that the knowledge of the second key k i , serving as implementation key unique to a circuit, allows the use of a protection control procedure to privileged users responsible for said control.
10. The circuit as claimed in any one of the preceding claims, characterized in that it is realized on a programmable circuit of the FPGA type.
11. The circuit as claimed in any one of the preceding claims, characterized in that the second key k i may be customized by way of an FPGA's programming file.
12. The circuit as claimed in any one of claims 1 to 9, characterized in that it is realized by a software implementation.
13. The circuit as claimed in any one of claims 10 or 11, characterized in that it comprises a third key k b for encrypting the programming file (25) of said FPGA circuit, this conferring the confidentiality of the external storage and of the transfer of the key k i to the FPGA.
14. The circuit as claimed in any one of the preceding claims, characterized in that the cardinal of the second key k i is equal to the cardinal of the functional key k c .
15. The circuit as claimed in any one of claims 13 or 14, characterized in that the cardinal of the third key k b is greater than or equal to the cardinal of the functional key k c .
16. The circuit as claimed in any one of the preceding claims, characterized in that the encryption algorithm is the DES algorithm.
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
FR0950342 | 2009-01-20 | ||
FR0950342A FR2941343B1 (en) | 2009-01-20 | 2009-01-20 | CIRCUIT OF CRYPTOGRAPHY, PROTECTS IN PARTICULAR AGAINST ATTACKS BY OBSERVATION OF LEAKS OF INFORMATION BY THEIR ENCRYPTION. |
PCT/EP2010/050547 WO2010084107A1 (en) | 2009-01-20 | 2010-01-18 | Cryptography circuit particularly protected against information-leak observation attacks by the ciphering thereof |
Publications (2)
Publication Number | Publication Date |
---|---|
CA2750358A1 true CA2750358A1 (en) | 2010-07-29 |
CA2750358C CA2750358C (en) | 2019-02-26 |
Family
ID=41111143
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CA2750358A Active CA2750358C (en) | 2009-01-20 | 2010-01-18 | Cryptography circuit particularly protected against information-leak observation attacks by the ciphering thereof |
Country Status (10)
Country | Link |
---|---|
US (2) | US20120045061A1 (en) |
EP (1) | EP2380305B1 (en) |
JP (1) | JP2012516094A (en) |
KR (1) | KR101712681B1 (en) |
CN (2) | CN108599917A (en) |
CA (1) | CA2750358C (en) |
ES (1) | ES2602827T3 (en) |
FR (1) | FR2941343B1 (en) |
SG (2) | SG196849A1 (en) |
WO (1) | WO2010084107A1 (en) |
Families Citing this family (18)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102571331A (en) * | 2012-02-07 | 2012-07-11 | 中国科学院软件研究所 | Cryptographic algorithm realization protecting method used for defending energy analysis attacks |
KR101373576B1 (en) * | 2012-12-26 | 2014-03-12 | 고려대학교 산학협력단 | Des encryption system |
KR101408619B1 (en) | 2013-01-14 | 2014-06-17 | 충북대학교 산학협력단 | Physical unclonable function system based on capacitance variations |
US9009495B2 (en) | 2013-06-28 | 2015-04-14 | Envieta, LLC | High speed cryptographic combining system, and method for programmable logic devices |
JP6789222B2 (en) * | 2014-10-13 | 2020-11-25 | イントリンシツク・イー・デー・ベー・ベー | Cryptographic device with non-duplicate physical functions |
US9531384B1 (en) * | 2014-12-01 | 2016-12-27 | University Of South Florida | Adiabatic dynamic differential logic for differential power analysis resistant secure integrated circuits |
US10530566B2 (en) * | 2015-04-23 | 2020-01-07 | Cryptography Research, Inc. | Configuring a device based on a DPA countermeasure |
DE102015213300A1 (en) | 2015-07-15 | 2017-01-19 | Siemens Aktiengesellschaft | Method and device for generating a device-specific identifier and devices comprising a personalized programmable circuit module |
ITUB20152708A1 (en) * | 2015-07-31 | 2017-01-31 | St Microelectronics Srl | PROCEDURE FOR OPERATING A CRITTOGRAPHY WITH SENSITIVE DATA MASKING, CRITTOGRAPHY AND CORRESPONDENT COMPUTER PRODUCT |
EP3226460A1 (en) * | 2016-04-01 | 2017-10-04 | Institut Mines-Telecom | Secret key estimation methods and devices |
US10389519B2 (en) * | 2016-09-30 | 2019-08-20 | International Business Machines Corporation | Hardware based cryptographic side-channel attack prevention |
JP6752247B2 (en) | 2018-03-09 | 2020-09-09 | 三菱重工業株式会社 | Information distribution device, distribution target device, information distribution system, information distribution method and program |
US10742406B2 (en) * | 2018-05-03 | 2020-08-11 | Micron Technology, Inc. | Key generation and secure storage in a noisy environment |
KR20200082982A (en) | 2018-12-31 | 2020-07-08 | 삼성전자주식회사 | Integrated circuit for security of physically unclonable function and device including the same |
US11218330B2 (en) | 2019-03-25 | 2022-01-04 | Micron Technology, Inc. | Generating an identity for a computing device using a physical unclonable function |
US11323275B2 (en) | 2019-03-25 | 2022-05-03 | Micron Technology, Inc. | Verification of identity using a secret key |
FR3096206A1 (en) * | 2019-05-17 | 2020-11-20 | Stmicroelectronics (Grenoble 2) Sas | MASKED DATA PROTECTION DEVICE AND ASSOCIATED METHOD |
CN113078996B (en) * | 2021-02-25 | 2022-09-13 | 西安电子科技大学 | FPGA (field programmable Gate array) optimization realization method, system and application of SM4 cryptographic algorithm |
Family Cites Families (23)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5768390A (en) * | 1995-10-25 | 1998-06-16 | International Business Machines Corporation | Cryptographic system with masking |
US7162031B1 (en) * | 1998-12-30 | 2007-01-09 | Nokia Corporation | Method and device for cryptographically processing data |
US7599491B2 (en) * | 1999-01-11 | 2009-10-06 | Certicom Corp. | Method for strengthening the implementation of ECDSA against power analysis |
GB0023409D0 (en) * | 2000-09-22 | 2000-11-08 | Integrated Silicon Systems Ltd | Data encryption apparatus |
FR2820577B1 (en) * | 2001-02-08 | 2003-06-13 | St Microelectronics Sa | SECURE SECRET KEY CRYPTOGRAPHIC CALCULATION METHOD AND COMPONENT USING SUCH A METHOD |
FR2825873A1 (en) * | 2001-06-11 | 2002-12-13 | St Microelectronics Sa | PROTECTED STORAGE OF DATA IN AN INTEGRATED CIRCUIT |
JP4596686B2 (en) * | 2001-06-13 | 2010-12-08 | 富士通株式会社 | Secure encryption against DPA |
WO2003075506A1 (en) * | 2002-03-07 | 2003-09-12 | Axalto Sa | Method for making safe an electronic cryptography assembly with a secret key |
CN100337442C (en) * | 2003-06-27 | 2007-09-12 | 华为技术有限公司 | A method of data integrity protection in WLAN |
JP4611643B2 (en) * | 2004-01-16 | 2011-01-12 | 三菱電機株式会社 | Individual key generator |
WO2005079069A1 (en) * | 2004-02-12 | 2005-08-25 | Philips Intellectual Property & Standards Gmbh | System for selective data transmission |
US7899190B2 (en) * | 2004-04-16 | 2011-03-01 | Research In Motion Limited | Security countermeasures for power analysis attacks |
EP1596278A1 (en) * | 2004-05-11 | 2005-11-16 | Axalto SA | Method to protect a cryptographic unit through homographic masking |
US8160244B2 (en) * | 2004-10-01 | 2012-04-17 | Broadcom Corporation | Stateless hardware security module |
EP1842203A4 (en) * | 2004-11-12 | 2011-03-23 | Verayo Inc | Volatile device keys and applications thereof |
US7949032B1 (en) * | 2005-05-16 | 2011-05-24 | Frost Edward G | Methods and apparatus for masking and securing communications transmissions |
CA2542556C (en) * | 2005-06-03 | 2014-09-16 | Tata Consultancy Services Limited | An authentication system executing an elliptic curve digital signature cryptographic process |
FR2893796B1 (en) * | 2005-11-21 | 2008-01-04 | Atmel Corp | ENCRYPTION PROTECTION METHOD |
US8171289B2 (en) * | 2006-06-09 | 2012-05-01 | Symantec Corporation | Method and apparatus to provide authentication and privacy with low complexity devices |
US20110002461A1 (en) * | 2007-05-11 | 2011-01-06 | Validity Sensors, Inc. | Method and System for Electronically Securing an Electronic Biometric Device Using Physically Unclonable Functions |
IL187046A0 (en) * | 2007-10-30 | 2008-02-09 | Sandisk Il Ltd | Memory randomization for protection against side channel attacks |
US20100150343A1 (en) * | 2008-12-15 | 2010-06-17 | Nxp B.V. | System and method for encrypting data based on cyclic groups |
FR2941342B1 (en) * | 2009-01-20 | 2011-05-20 | Groupe Des Ecoles De Telecommunications Get Ecole Nat Superieure Des Telecommunications Enst | CRYPTOGRAPHIC CIRCUIT PROTECTED AGAINST ATTACKS IN OBSERVATION, IN PARTICULAR OF HIGH ORDER. |
-
2009
- 2009-01-20 FR FR0950342A patent/FR2941343B1/en active Active
-
2010
- 2010-01-18 CN CN201810384907.0A patent/CN108599917A/en active Pending
- 2010-01-18 CN CN2010800049766A patent/CN102388563A/en active Pending
- 2010-01-18 SG SG2014004535A patent/SG196849A1/en unknown
- 2010-01-18 US US13/145,181 patent/US20120045061A1/en not_active Abandoned
- 2010-01-18 WO PCT/EP2010/050547 patent/WO2010084107A1/en active Application Filing
- 2010-01-18 SG SG2011053253A patent/SG173110A1/en unknown
- 2010-01-18 EP EP10700868.2A patent/EP2380305B1/en active Active
- 2010-01-18 CA CA2750358A patent/CA2750358C/en active Active
- 2010-01-18 JP JP2011546771A patent/JP2012516094A/en active Pending
- 2010-01-18 KR KR1020117016921A patent/KR101712681B1/en active IP Right Grant
- 2010-01-18 ES ES10700868.2T patent/ES2602827T3/en active Active
-
2020
- 2020-02-24 US US16/798,515 patent/US20200195417A1/en not_active Abandoned
Also Published As
Publication number | Publication date |
---|---|
KR20120018108A (en) | 2012-02-29 |
US20200195417A1 (en) | 2020-06-18 |
CN102388563A (en) | 2012-03-21 |
FR2941343B1 (en) | 2011-04-08 |
EP2380305B1 (en) | 2016-08-17 |
WO2010084107A1 (en) | 2010-07-29 |
KR101712681B1 (en) | 2017-03-06 |
US20120045061A1 (en) | 2012-02-23 |
SG173110A1 (en) | 2011-08-29 |
EP2380305A1 (en) | 2011-10-26 |
CA2750358C (en) | 2019-02-26 |
FR2941343A1 (en) | 2010-07-23 |
JP2012516094A (en) | 2012-07-12 |
WO2010084107A9 (en) | 2011-09-22 |
ES2602827T3 (en) | 2017-02-22 |
SG196849A1 (en) | 2014-02-13 |
CN108599917A (en) | 2018-09-28 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20200195417A1 (en) | Cryptography circuit particularly protected against information-leak observation attacks by the ciphering thereof | |
Barenghi et al. | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures | |
Swierczynski et al. | Bitstream fault injections (BiFI)–automated fault attacks against SRAM-based FPGAs | |
US9197412B2 (en) | Low-complexity electronic circuit protected by customized masking | |
US9806881B2 (en) | Cryptographic processor, method for implementing a cryptographic processor and key generation circuit | |
CN105406957B (en) | Encryption device confrontation is protected to realize attack | |
EP1836554A1 (en) | Method and related device for hardware-oriented conversion between arithmetic and boolean random masking | |
Sasdrich et al. | White-Box Cryptography in the Gray Box: –A Hardware Implementation and its Side Channels– | |
Chhabra et al. | Enhancing data security using obfuscated 128-bit AES algorithm-an active hardware obfuscation approach at RTL level | |
Moradi | Advances in side-channel security | |
Koblah et al. | Hardware Moving Target Defenses against Physical Attacks: Design Challenges and Opportunities | |
US11303436B2 (en) | Cryptographic operations employing non-linear share encoding for protecting from external monitoring attacks | |
Gupta et al. | Correlation power analysis on KASUMI: attack and countermeasure | |
Gupta et al. | Correlation power analysis of KASUMI and power resilience analysis of some equivalence classes of KASUMI S-boxes | |
Mohammad et al. | Required policies and properties of the security engine of an SoC | |
Duarte-Sanchez et al. | A cube attack on a trojan-compromised hardware implementation of Ascon | |
Chhabra et al. | Design and analysis of logic encryption based 128-bit aes algorithm: A case study | |
CN111602367B (en) | Method for protecting entropy sources used in countermeasures for securing white-box cryptographic algorithms | |
Taha et al. | Keymill: Side-channel resilient key generator | |
Gaspar | Crypto-processor–architecture, programming and evaluation of the security | |
Masoumi | Design and Evaluation of a Power Analysis Resilient Implementation of Piccolo-80 Lightweight Encryption Algorithm | |
Chhabra et al. | Towards the enhancement of AES IP security using hardware obfuscation technique: A practical approach for secure data transmission in IoT | |
US12072379B2 (en) | Dynamic scan obfuscation for integrated circuit protections | |
Gandhi et al. | LOKI: a secure FPGA Prototyping of IoT IP with lightweight logic locking | |
US20230288477A1 (en) | Dynamic scan obfuscation for integrated circuit protections |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
EEER | Examination request |
Effective date: 20141230 |